Safe Sign In

Text-message codes are better than nothing, but an authenticator app is a step up. It generates short-lived codes on your device, so a thief cannot read them from a stolen text or a hijacked phone number. The harder question is which app to pick, because the differences that matter are not about looks. They are about what happens when you lose or replace your phone. This guide compares four popular choices: Google Authenticator, Microsoft Authenticator, the Passwords app built into Apple devices, and Authy. It explains what to check before you commit and how to avoid getting locked out. Features change, so check each vendor's help page for current details. Why an Authenticator App Beats Text Messages The Cybersecurity and Infrastructure Security Agency (CISA) describes multifactor authentication (MFA) as a way to protect your accounts even if a password is stolen. It lists text messages, authenticator apps that produce a new code every 30 seconds, and biometrics as options. CI...

Last updated: October 10, 2026 A security key is a small physical device, often shaped like a USB stick or a fob, that you use to prove it is really you signing in. You plug it in, tap it or hold it near your phone, and the website lets you in. Brands such as Yubico (YubiKey), Google (Titan Security Key) and others make them. They have a reputation as the strongest form of two-factor authentication for ordinary users, and US government guidance backs that up. That does not mean everybody needs one. This guide explains what a key does, why it resists phishing, how to choose the right type and connector, how to set one up on Google, Apple, Microsoft and X accounts, and how to decide whether it is worth buying. What Is a Security Key? A hardware security key is "something you have." In the classic setup it is a second factor: you still enter your password, and then the key confirms that you are present. Google's help page on security keys says they can be used with 2-...

Last updated: October 13, 2026 Your phone number has quietly become a master key. Banks, email providers and social networks send verification codes to it, and many "forgot password" flows end with a text message. If a criminal takes control of your number, those messages go to them instead of you. That is the idea behind a SIM swap, and it is one of the few attacks that can defeat an account protected by a password and SMS codes at the same time. This guide explains how SIM swap and port-out fraud work, what US regulators now require from carriers, how to spot an attack in the first minutes, exactly what to do if it happens, and how to make your number a much harder target. It is based on guidance from the Federal Communications Commission (FCC) , the FBI's Internet Crime Complaint Center (IC3) and the Federal Trade Commission (FTC) . What Is a SIM Swap? A SIM card, or the eSIM profile built into newer phones, links your handset to your phone number. In a SIM swap...

Last updated: October 8, 2026 You may have noticed sign-in pages offering to "create a passkey" and wondered whether it is a gimmick. It is not. Passkeys are a serious attempt to replace passwords with something that cannot be guessed, reused or typed into a fake website. Big platforms such as Google, Apple and Microsoft, along with many other services, now support them. This guide explains what a passkey is, why security agencies and experts favor it, where it falls short, how it compares with passwords and two-factor codes, and how to set up passkeys on your Google, Apple and Microsoft accounts without locking yourself out. What Is a Passkey? A passkey is a login credential based on public-key cryptography. When you create one for a website or app, your device generates a pair of linked keys: A public key , which is stored by the website. It is not secret, so a breach of the website does not reveal anything that lets an attacker sign in as you. A private key , whic...

Last updated: October 8, 2026 An authenticator app generates short-lived numeric codes on your phone. When you sign in to a protected account, you type your password and then the current code. Because the code changes every 30 seconds or so and never travels by text message, it is a stronger second step than SMS for most people. Google Authenticator is one of the best-known apps for this. The setup takes a few minutes, but the part most people skip is the backup. If your phone is lost, broken or replaced and you have no backup plan, you can be locked out of the accounts you were trying to protect. This guide covers both. How Authenticator Apps Work When you enable app-based two-factor authentication on a website, the site shows a QR code (and usually a text "setup key"). That code contains a secret value shared between the site and your app. Both sides use that secret and the current time to calculate the same six-digit number. This is why the app works without an inte...

Last updated: October 8, 2026 A password alone is a fragile lock. Passwords get guessed, reused, leaked in data breaches and stolen by fake login pages. Two-factor authentication (2FA), sometimes called two-step verification or multi-factor authentication, adds a second check so that a stolen password is not enough on its own. But not all 2FA methods are equal. This guide explains how it works, compares text message codes, authenticator apps and physical security keys, and shows how to set it up without locking yourself out. What Is Two-Factor Authentication? Authentication factors fall into three broad groups: Something you know: a password or PIN. Something you have: your phone, an app or a hardware key. Something you are: a fingerprint or face scan. 2FA combines two of these. Typically you enter your password (something you know), then prove you have your phone or key (something you have). An attacker who only has your password gets stopped at the second step. Note t...